Security
An agency holds the keys to brands larger than itself
The most valuable thing in this system is not your content - it is the access your clients have granted you. Everything below follows from treating it that way.
We never see a social media password
Accounts connect through the platform's own sign-in screen. Your client authorises us directly with Facebook, LinkedIn or TikTok. There is no field anywhere in Socio Pulse to type a social media password into, because we never want one.
Access tokens are encrypted and bound
Platform tokens are encrypted with AES-256-GCM before storage, and each one is cryptographically tied to the specific account it belongs to. A token record copied from one account's row to another simply fails to decrypt - so a database compromise does not become a token-swapping attack.
No one can read a token - including us
There is no screen, export, API or support tool that displays a stored token. No role has that capability, our own administrators included. The only code path that decrypts one hands it straight to the platform's API.
Agencies are separated, and it is tested
Every database query is scoped to a single agency. This is not a convention the team remembers - the data layer has no method that accepts an unscoped identifier. An automated suite deliberately attempts cross-agency access on every build and fails the build if any of it succeeds.
Passwords are hashed with Argon2id
Argon2id with a 64 MB memory cost - deliberately expensive to attack with purpose-built hardware. We cannot recover your password, and neither can anyone who obtains the database. Hashes are transparently upgraded on sign-in as the parameters get stronger.
Least privilege, by role
A designer assigned to three clients reaches three clients. A client user reaches their own business. Permissions are data, not code, so what a role can do is auditable rather than scattered through the application.
Secrets never reach the disk
Tokens, passwords, signatures and payment details are stripped before a log line or an error report is written - not filtered afterwards. Once a secret is on disk it is in a backup, a support ticket and a screenshot, so the only reliable place to remove it is before writing.
A real audit trail
Who created, approved, scheduled, published, disconnected or deleted something, and when. Approval records are append-only: they are never updated and never deleted, because they are the evidence of what a client agreed to.
Where your data lives
| Data | Location |
|---|---|
| Application and database - accounts, content, approvals, tokens | Sydney, Australia |
| Uploaded media - images, video, documents | Cloudflare R2, automatic placement across their global network |
| Transactional email | Resend, United States |
| Card payments | Stripe - card details never reach our servers |
Media storage is the one item that is not Australian-only, and we state that plainly here and in the Privacy Policy rather than leaving you to assume otherwise. If Australian-only media storage is a requirement for your clients, contact us before you subscribe.
In transit
All traffic is HTTPS with HSTS enforced. The application sets a strict Content Security Policy with no inline scripts permitted, along with clickjacking and MIME-sniffing protections. Media is served through short-lived signed links rather than from a public bucket, so a link that leaks is worthless within the hour.
Reporting a vulnerability
If you believe you have found a security issue, email security@sociopulse.com.au with "Security" in the subject. Please give us a reasonable opportunity to fix it before disclosing it publicly. We will acknowledge within 2 business days.
Please do not run automated scanners or load tests against the service - clause 6 of the Terms prohibits it, and it is indistinguishable from an attack from where we sit. Tell us what you want to test and we will arrange it.
Honest limits
Things we have not done yet, stated rather than implied:
- We do not hold ISO 27001 or SOC 2 certification.
- We have not commissioned an independent third-party penetration test.
- Two-factor authentication is built into the data model but is not yet available to turn on.
- We do not offer a contractual uptime guarantee.
If any of these is a requirement for your clients, tell us - we would rather know before you commit than after.